Bio-metric smart card, bio-metric smart card reader and method of use

• US 6,816,058 B2
• Filed: 04/26/2001
• Issued: 11/09/2004
• Est. Priority Date: 04/26/2001
• Status: Expired due to Fees

• Current Assignee: Validus Technologies Corporation
• Original Assignee: Validus Technologies Corporation
• Inventors: McGregor, Christopher M., McGregor, Travis M., McGregor, D. Scott
• Primary Examiner(s): Horabik, Michael
• Assistant Examiner(s): AU, SCOTT D
• Application Number:
  US09/843,572
• Publication Number:
  US 20020158747A1
• Time in Patent Office: 1,293 Days
• Field of Search: 340/5.26, 340/5.22, 340/5.23, 340/5.24, 340/5.51, 340/5.6, 235/375, 235/379, 235/386, 380/255, 380/277-47, 705/50-80, 713/150-186, 382/115-127
• US Class Current: 340/5.26
• CPC Class Codes: G05B 19/0425 Safety, monitoring
• CPC Class Codes: G05B 2219/23342 Pluggable rom, smart card
• CPC Class Codes: G05B 2219/24162 Biometric sensor, fingerprint as user access password
• CPC Class Codes: G05B 2219/24167 Encryption, password, user access privileges
• CPC Class Codes: G05B 2219/25192 Infrared
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3415 Cards acting autonomously as pay-media
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/4097 using mutual authentication between devices and transaction partners
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence
• CPC Class Codes: G07C 9/26 using a biometric sensor integrated in the pass
• CPC Class Codes: G07F 7/0886 the card reader being portable for interacting with a POS or ECR in realizing a payment transaction
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

A system for increasing transaction security across existing infrastructure is provided. A user bio-metric sensor device is integrated into a credit or debit card. A display unit provides a key, preferably encrypted, upon successful utilization of the sensor device. Included in the key generation mechanism is an indicator of the transaction number or other sequential count indicative of card use. An authorization service decrypts the key in a manner at least partially dependent upon a second sequential count maintained in sync with the first count to determine whether the use is authorized.

Claims

1. An apparatus for preventing the unauthorized use of at least one non-varying account number, the apparatus comprising:

a user authenticator with bio-metric authentication input providing the apparatus with a user'"'"'s bio-metric authentication data for proving the user is authorized to use the at least one on-varying account number;

a transaction counter for tracking authorized device access events with contents derived from authorized device access events;

a processor in electrical communication with the user authenticator and counter, the processor being programmed to generate a security key in response to the bio-metric authorization authentication data received via the user authenticator, the security key being derived at least in part from the contents of the counter and at least in part from the user'"'"'s bio-metric authentication data; and

a display unit to display the security key on the apparatus.

2. The apparatus of claim 1, wherein the security key is encrypted before being displayed.

3. The apparatus of claim 1, further comprising a wireless transmitter to transmit the security key to a network device.

4. The apparatus of claim 3, further comprising a smart card reader, wherein the apparatus can be used with existing smart cards to provide a security key for transactions.

5. The apparatus of claim 1, wherein the apparatus is connected to a computer to authorize transactions on a network.

6. The apparatus of claim 1, wherein the user authenticator is a fingerprint scanner.

7. A system or securely processing transactions with an account, the system comprising:

a) a security key device, the device including;

i) a user authenticator with a bio-metric authentication input providing the device with the user'"'"'s bio-metric authentication data for proving the user is authorized to use the account;

ii) a first counter in electrical communication with the user authenticator, the first counter having representative of authorized device access events;

iii) a key generation processor in electrical communication with the user authenticator and counter, the processor being programmed to generate a security key in response to authentication data received via the user authenticator, the security key being derived at least in part from the contents of the first counter and at least in part from the user'"'"'s bio-metric authentication data;

iv) an electronic display in electrical communication with the processor, for displaying the security key on the security key device;

b) a second counter being connected to receive a remote indicator of a successful device access event, the second counter having contents representative of successful device access events; and

c) a key confirmation processor programmed to confirm an authenticity of the security key in a manner at least partially dependent upon the contents of the second counter.

8. The system of claim 7, wherein the security key is derived from the contents of the first counter and a user'"'"'s bio-metric authentication data.

9. The system of claim 7, wherein the user authenticator is a fingerprint scanner.

10. The system of claim 7, wherein the key confirmation processor approves a transaction if the count of successful device access events is within a predefined number of the count of authorized device access events of the first counter.

11. The system of claim 7, wherein the security key is encrypted before being displayed and the key confirmation processor decrypts the key in order to authenticate a transaction.

12. A method of securely authorizing a transaction utilizing an account, the method comprising:

confirming an authorized use of a account card via a bio-metric sensor;

generating user'"'"'s bio-metric authentication data from a user'"'"'s input via the bio-metric sensor;

maintaining a first count indicative of a number of instances of such authorized uses;

generating a security key in a manner at least partially dependent upon the count, and at least partially dependent upon the user'"'"'s bio-metric authentication data;

transmitting the security key to an authorizing authority;

processing the security key at the authorizing authority;

maintaining a second count indicative of a number of transmissions received by the authorizing authority for the account;

confirming that the security key was generated by an authorized user at least in part through use of the user'"'"'s bio-metric authentication data and in part through the use of the first count and the second count; and

authorizing the transaction if the security key was generated by an authorized user.

13. The method of claim 12, wherein the bio-metric sensor is a fingerprint sensor.

14. The method of claim 12, wherein the security key is generated using an encryption algorithm to process a card key and the first count.

15. The method of claim 12, wherein the transaction is authorized if the first count is within a predefined number of the second count.

16. The method of claim 14, wherein the card key is generated from a master key provided by the account provider and from the user'"'"'s bio-metric authentication data.